McGuire Nuclear Station Environmental Report Operating License Renewal Stage Attachments

Attachment K

McGuire Nuclear Station Severe Accident Mitigation Alternatives (SAMAs) Analysis May 2001 Final Report McGUIRE NUCLEAR STATION

Severe Accident Mitigation Alternatives (SAMAs) Analysis

May 2001 Final Report McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

TABLE OF CONTENTS

TOPIC PAGE

1.0 Introduction and Background ...... 1 2.0 Risk Reduction Measures Previously Considered...... 3 2.1 Past Studies...... 3 2.2 Ongoing Initiatives...... 6 3.0 Methodology For Identifying Additional SAMAs...... 8 4.0 SAMAs Considered For Core Damage Frequency Reduction...... 9 4.1 Current McGuire Core Damage Frequency Profile ...... 9 4.2 Identification Of Potential SAMAs ...... 10 4.3 Analysis Of Potential SAMAs...... 10 4.4 Cost-Benefit Analysis For Selected SAMAs ...... 16 5.0 SAMAs Considered For Person-rem Risk Reduction...... 20 5.1 Current McGuire Person-rem Risk Profile...... 20 5.2 Identification Of Potential Containment-Related SAMAs ...... 21 5.3 Analysis Of Potential Containment-Related SAMAs ...... 23 5.4 Cost-Benefit Analysis For Containment-Related SAMAs ...... 25 6.0 Overall Results...... 28 7.0 Conclusions ...... 31 8.0 References ...... 32

iii McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

1.0 Introduction and Background

This report presents the “consideration of alternatives to mitigate severe accidents” for McGuire Nuclear Station, in compliance with environmental review requirements in 10CFR51.53(c)(3)(ii)(L). For this analysis, SAMAs (severe accident mitigation alternatives) will include a review of potential design alternatives (SAMDAs - severe accident mitigation design alternatives) along with any procedural, non-hardware, alternatives. The objective of the SAMAs review is to facilitate the consideration of cost- beneficial plant modifications that could reduce the risk of severe accidents for plant operation during the license renewal period. This is achieved by identifying potential plant enhancements that could provide substantial severe accident benefit and then assessing the need and viability of those enhancements from a cost-benefit standpoint. The severe accident benefit is assessed in terms of the total averted risk (including averted public exposure, averted onsite cleanup cost, averted onsite exposure risk, and averted offsite property damage) by the proposed alternative. The cost-benefit analysis is performed using 2000 dollars for the cost of alternatives and the present worth of averted costs. Supplement 1 to Regulatory Guide 4.2 [Reference 1.1] is used as guidance for the McGuire SAMAs analysis. This Regulatory Guide states:

“The results of the following analytical steps should be presented in the Environmental Report, and the methodology or analytical process should be described.

1. Based on the plant-specific risk study and supplementary analyses, identify and characterize the leading contributors to core damage frequency and offsite risk (i.e., population dose). 2. From the IPEEE and any other external event analyses, provide estimates of the incremental contribution to dose consequence risk identified from the IPE. 3. Identify practical physical plant modifications and plant procedural and administrative changes that can reduce severe accident dose consequence risk. For each modification or change, estimate the approximate reduction in risk. 4. Estimate the value of the reduction in risk. Value is usually calculated for public health, occupational health, offsite property, and onsite property. 5. Estimate the approximate cost of each modification and procedural and administrative change found to reduce consequence risk of severe accidents. Potential SAMAs that are not expected to be cost beneficial may be screened out based on a bounding analysis. 6. Perform a more detailed value-impact analysis for remaining SAMAs to identify any plant modifications and procedural changes that may be cost effective. 7. List plant modifications and procedural changes (if any) that have or will be implemented to reduce the severe accident dose consequence risk.”

1 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

As background, Duke Energy (Duke) has been actively involved since before 1984 in the development of plant-specific probabilistic risk assessments (PRA), individual plant examinations (IPE/IPEEE), and component/system reliability studies to evaluate severe accidents at McGuire (see Section 2.0). These studies have led to changes in the plant configuration and enhancements in plant procedures to reduce vulnerability of the plant to certain accident sequences.

This report presents an assessment of additional alternatives that could be implemented based on the current McGuire risk profile. Section 3.0 discusses the methodology used by Duke to perform this assessment. The methodology selected for this analysis involves reviewing the current risk profile using the McGuire PRA Revision 2 results and identifying: (a) the severe accident sequences dominating the core damage frequency (CDF), and (b) the severe accident sequences dominating the person-rem risk. In Sections 4.0 and 5.0, the list of potential alternatives are screened using a high-level cost- benefit comparison. A more detailed cost-benefit analysis is performed on those candidates that survive the initial screening analysis.

In addition, Duke has implemented two ongoing programs—the Maintenance Rule Program and the Severe Accident Management Guideline Program to manage severe accident risk. These are described in Section 2.2.

2 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

2.0 Risk Reduction Measures Previously Considered

The following paragraphs provide brief descriptions of previous studies that have been performed by Duke to identify potential plant enhancements at McGuire. The McGuire PRA study, which was published in 1984, was performed prior to the existence of regulatory guidance. The IPE and IPEEE studies were performed in response to Generic Letter 88-20, as supplemented. The McGuire switchyard reliability study was performed at Duke’s initiative to assess the reliability of the off-site power system and any potential plant enhancements that needed to be implemented to further reduce the risk associated with the failure of this system.

2.1 Past Studies

McGuire PRA

In 1984, Duke completed an initial study documenting a full-scope Level 3 PRA for McGuire Nuclear Station. The McGuire PRA study identified the major failure combinations that can lead to core damage, and Duke has taken initiative in making plant enhancements as a result of the study. Table 2-1 identifies the plant enhancements implemented as part of the initial study.

McGuire IPE

In 1988, Duke initiated a large-scale review and update of the initial study. The major objectives of the review and update were to incorporate plant changes made since the time of the original study, improve on assumptions made in the original study, make use of plant experience/data from the 1980s, and utilize improvements in PRA methodology and up-to-date techniques.

On November 23, 1988, the NRC issued Generic Letter 88-20 [Reference 2.1], which requested that licensees conduct an Individual Plant Examination (IPE) in order to identify potential severe accident vulnerabilities at their plants. The McGuire response to GL 88-20 was provided by letter dated November 4, 1991 [Reference 2.2]. McGuire’s response included the updated McGuire PRA (Revision 1) study. The McGuire PRA Revision 1 study and the IPE process resulted in a comprehensive, systematic examination of McGuire with regard to potential severe accidents. The McGuire study was a full-scope, Level 3 PRA with analysis of both the internal and external events. This examination identified the most likely severe accident sequences, both internally and externally induced, with quantitative perspectives on their likelihood and fission product release potential. The results of the study have prompted changes in equipment, plant configuration and enhancements in plant procedures to reduce vulnerability of the plant to some accident sequences of concern which are identified in Table 2-1.

3 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

By letter dated June 30, 1994 [Reference 2.3], the NRC provided an evaluation of the internal events portion of the above McGuire IPE submittal. The conclusion of the NRC letter [page 15] states:

The staff finds the licensee’s IPE submittal for internal events including internal flooding essentially complete, with the level of detail consistent with the information requested in NUREG-1335. Based on the review of the submittal and the associated supporting information, the staff finds reasonable the licensee’s IPE conclusion that no fundamental weakness or severe accident vulnerabilities exist at McGuire. The staff notes:

(1) Duke Power Company personnel were considerably involved in the development and application of Probabilistic Safety Assessment techniques to the McGuire facility, and that the associated walkdowns and documentation reviews constituted a viable process for confirming that the IPE represents the as-built, as-operated plant. (2) The front-end IPE analysis appears complete, with the level of detail consistent with the information requested in NUREG-1335. In addition, the employed analytical techniques reflect commonly accepted practices and are capable of identifying potential core damage vulnerabilities. (3) The back-end analysis addressed the most important severe accident phenomena normally associated with ice condenser containments, for instance, direct containment heating (DCH), induced steam generator tube rupture (ISGTR), and hydrogen combustion. No obvious or significant problems or errors were identified. (4) The human reliability analysis (HRA) allowed the licensee to develop a quantitative understanding of the contribution of human errors to core damage frequency (CDF) and containment failure probabilities. (5) Based on the licensee’s IPE process used to search for decay heat removal (DHR) vulnerabilities, and review of McGuire plant-specific features, the staff finds the DHR evaluation consistent with the intent of the USI A-45 (Decay Heat Removal Reliability) (6) The licensee’s response to Containment Performance Improvement (CPI) Program recommendations, which include searching for vulnerabilities associated with containment performance during severe accidents, is reasonable and consistent with the intent of Generic Letter 88-20, Supplement 3.

In addition, and consistent with the intent of Generic Letter 88-20, the staff believes the licensee’s peer review process provided assurance that the IPE analytical techniques had been correctly applied and that documentation is accurate.

Based on the above findings, the staff concludes that the licensee demonstrated an overall appreciation of severe accidents, has an understanding of the most likely severe accident sequences that could occur at the McGuire facility, has gained a

4 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

quantitative understanding of core damage and fission product release, responded to safety improvement opportunities. The staff, therefore, finds the McGuire IPE process acceptable in meeting the intent of Generic Letter 88-20. The staff also notes that the licensee’s intent to continue use of the IPE as a “living” document, will enhance plant safety and provides additional assurance that any potential unrecognized vulnerabilities would be identified and evaluated during the lifetime of the plant.

McGuire IPEEE

In response to Generic Letter 88-20, Supplement 4, Duke completed an Individual Plant Examination of External Events (IPEEE) for severe accidents. This IPEEE was submitted to the NRC by letter dated June 1, 1994 [Reference 2.4]. The report contains a summary of the methods, results and conclusions of the McGuire IPEEE program. The IPEEE process and supporting McGuire PRA include a comprehensive, systematic examination of severe accident potential resulting from external initiating events. The McGuire IPEEE has identified the severe accident sequences of significance resulting from the external initiating events with quantitative perspectives on their likelihood. Significantly, no fundamental plant weaknesses or vulnerabilities with regard to external events were identified during the IPEEE examination. However, enhancements to plant hardware and procedural guidelines have been recommended. Table 2-1 identifies the enhancements implemented as a result of the IPEEE analysis.

By letter dated February 16, 1999 [Reference 2.5], the NRC provided an evaluation of the above McGuire IPEEE submittal. The conclusion of the NRC letter [page 6] states:

The staff finds the licensee’s IPEEE submittal is complete with regard to the information requested by Supplement 4 to GL 88-20 (and associated guidance in NUREG-1407), and the IPEEE results are reasonable given the McGuire design, operation, and history. Therefore, the staff concludes that the licensee’s IPEEE process is capable of identifying the most likely severe accidents and severe accident vulnerabilities, and therefore, that the McGuire IPEEE has met the intent of Supplement 4 to GL 88-20.

McGuire Switchyard Study

In 2000, Duke completed an initial study for the McGuire offsite power system confirming the high reliability of the switchyard design and configuration. The results of the study identify human error, equipment associated with runback of a unit generator, and equipment supporting unit bus line power paths as the dominant contributors to system unavailability. These insights are expected to enhance offsite power system configuration and control.

5 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

2.2 Ongoing Initiatives

The following two programs are ongoing initiatives at Duke to further reduce the risk associated with the plant operation of McGuire. The first program discussed is the McGuire ORAM-Sentinel, which was implemented at McGuire in response to 10CFR 50.65. The second program, the Severe Accident Management Guidelines Program, is in response to a regulatory requirement for closure of the severe accident regulatory issue (SECY 88-147, Generic Letter 88-20).

McGuire Maintenance Rule (ORAM-SENTINEL) Program

In 1996, Duke implemented the McGuire Maintenance Rule Program as an administrative program to ensure that structures, systems, and components important to safety are available and capable of reliably performing their intended safety function. The program requires the monitoring of availability and reliability of Maintenance Rule SSCs against predetermined performance criteria. The performance criteria are set commensurate with safety and benchmarked against the McGuire PRA to ensure that any potential impact on overall plant core damage frequency is minimized and acceptable.

A configuration risk management program is also used to manage the increase in risk that may result from maintenance activities. In conjunction with governing administrative procedures, the ORAM-Sentinel computer software program is used to evaluate the change in core damage frequency from maintenance activities as well as to evaluate their impact on the level of "defense-in-depth" for key plant safety functions. All planned maintenance activities are evaluated for their potential impact on plant risk prior to execution, and then schedules are adjusted to optimized to achieve the lowest possible risk configurations. For shutdown conditions, an administrative process is used in a similar manner to assess and manage outage risk.

McGuire Severe Accident Management Guideline (SAMG) Program

Another severe accident initiative that has been undertaken by Duke is the development and implementation of Severe Accident Management Guidelines (SAMG). In December 1997, Duke completed all the training and procedures for the SAMG program. This formal program makes use of available plant resources to manage severe accidents, should they occur. It includes diagnostic tools and severe accident management guideline documents for developing strategies during an event to arrest core damage progression and mitigate fission product releases in the event of a severe accident. SAMG training is given to Emergency Response Organization personnel to provide an understanding of severe accident phenomenon and the use of the tools and guideline documents.

This SAMG program achieves an incremental risk reduction capability without reliance on additional hardware and resources.

6 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

TABLE 2-1 Risk Reduction Measures Implemented At McGuire

Past Studies Alternatives Implemented As A Result Of Findings From Study McGuire PRA initial study Alternatives implemented as a result of the original McGuire PRA analysis: • Procedural guidance for operator’s use was developed and implemented to better cope with a loss-of-nuclear service water event. • Operator actions for the loss of ac power procedure were prioritized such that the action to locally isolate the containment ventilation unit condensate drain line could be taken reliably. • Another plant enhancement related to a potential flooding condition in the auxiliary feedwater pump room. Expansion joints in the nuclear service water piping located in this room were discovered not to include a metal collar to limit the leakage. Thus, to reduce the likelihood of a large flooding event from this source, the expansion joints have been subsequently fitted with a collar to limit the leak rate. The McGuire IPE study Alternatives implemented as a result of the McGuire IPE results included modifications to procedures to: • direct operators to not restart reactor coolant pumps while in plant emergency procedure for inadequate core cooling conditions with no secondary side heat removal and the pressurizer PORVs are not open. With no secondary side heat removal and pressurizer PORVs closed, the forced circulation of very hot gases from the core at high pressure could overstress the steam generator tubes, creating a containment bypass situation. Additional procedural guidance to permit pump startup only when the stream generator tubes are covered with a mixture level has been implemented. • exercise the nuclear service water cross-connect valves between Unit 1 and 2 during each refueling outage. • an Emergency Diesel Generator System Reliability Centered Maintenance study was performed providing several recommendations (i.e., hardware modifications and changes to the maintenance program), which were implemented to enhance the reliability of the Emergency Diesel Generator System. • training exercises were performed to demonstrate that the operators can activate the SSF within 10 minutes. • In addition, the sump recirculation phase of the loss-of-coolant accident mitigation relies upon the FWST “Lo” level and “Lo-Lo” level signals. The span of the transmitters was scaled to the 0-160” range to minimize the span error of the instrumentation. With normal FWST level of 460”, this instrument was susceptible to an undetected “failed-high” or “failed as-is” failure mode during normal operation. Therefore, the FWST level instrument span has been expanded to the full range to reduce the contribution from this failure mode to the sump recirculation failure. The McGuire IPEEE study Alternatives implemented as a result of the McGuire IPEEE results include several modifications to plant based on fire, tornado and seismic analysis which are contained in the McGuire IPEEE Report [Reference 2.4]. Those plant enhancements already completed include such items as adding spacers between Diesel Generator batteries and racks, adding grout between Component Cooling Heat Exchangers saddle base and concrete curb, trimming grate around Steam Vent valves, installing missing bolts to Upper Surge Tanks, modifying Turbine Driven Auxiliary Feedwater Pump Control Panel to avoid seismic interaction with pipe, replacing or cleaning and recoating corroded nuts on Auxiliary Feedwater Condensate Storage Tank anchor bolts, tighten arc barrier connections inside Main Control Boards. In addition, procedural guidelines have been developed to secure movable equipment and structures to prevent potential seismic interactions.

7 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

3.0 Methodology For Identifying Additional SAMAs

The analysis methodology selected for this analysis involves identifying those severe accident mitigation alternatives, which would have the most significant impact on reducing core damage frequency and person-rem risk. The approach used in this analysis consists of:

• developing the information on the current risk profile from the McGuire PRA Revision 2 results showing the distribution of the core damage frequency and person- rem risk (see Sections 4.1 and 5.1),

• identifying potential severe accident candidates for consideration of additional severe accident mitigation alternatives, and screening out those potential severe accident mitigation alternatives with low or marginal benefit (see Sections 4.2 and 5.2),

• further eliminating those alternatives whose implementation would not be expected to be cost-beneficial (see Sections 4.3 and 5.3),

• performing a cost-benefit analysis on the final set of potential alternatives to determine whether or not the implementation of the alternatives would be cost- beneficial (see Sections 4.4 and 5.4),

• finally, integrating the overall results and current initiative, and determining whether any further severe accident mitigation alternatives should be applied for license renewal (see Sections 6.0 and 7.0).

The current severe accident risk results are available from the 1997 update of the McGuire PRA Revision 2 [Reference 3.1]. As before, this update constitutes a full-scope Level 3 PRA with the analysis of both internal and external events. This McGuire PRA Revision 2 update provides a relatively current profile of the severe accident risk for McGuire characterized by (i) core damage frequency - the risk of core damage severe accidents which could release substantial fission products and (ii) person-rem risk - the risk of release of significant fission products offsite given a core damage accident. For this analysis the person-rem risk results are updated using the MELCOR Accident Consequence Code System (MACCS2) computer code with more recent meteorological data (1999 data) and 50-mile population estimates for the year 2040.

8 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

4.0 SAMAs Considered For Core Damage Frequency Reduction

The following sections explain how the current McGuire PRA results are evaluated for potential SAMAs to reduce core damage frequency. Section 4.1 describes the current McGuire core damage frequency profile. Section 4.2 defines the process of selecting the top cut sets for consideration of SAMAs based on contribution to core damage frequency. Section 4.3 provides the analysis of potential SAMAs where the seismic and non-seismic initiators are examined separately since there is a distinct difference in the amount of plant damage in the event of such accident initiators. After examining the cut sets, an additional approach to identifying potential SAMAs beyond those selected from evaluating the cut set listings is applied by reviewing the basic event importance ranking. This basic event importance ranking provides a means of determining if some individual basic events contribute significantly to the core damage frequency that may not have been identified in the cut set review. Finally, Section 4.4 provides the cost-benefit analysis for selected SAMAs.

4.1 Current McGuire Core Damage Frequency Profile

The current calculated total (internal and external initiating events) core damage frequency for McGuire is 4.9E-05 per year[Reference 3.1]. The following presents the total core damage frequency distributed among the identified internal and external events.

The internal events represent about 57% of the total core damage frequency as follows:

Initiating Events Frequency Transients (Reactor Trips, Loss of Main Feedwater, 1.5E-05 /yr Loss of Operating 4 kV ac Bus, Loss of RN, etc.) LOCAs (Small, Medium, and Large) 1.1E-05 /yr Internal Flood 8.7E-07 /yr Anticipated Transient Without Scram 1.5E-07 /yr Steam Generator Tube Rupture 7.8E-10 /yr Reactor Pressure Vessel Rupture 1.0E-06 /yr Interfacing-Systems LOCA 2.2E-07 /yr Total Internal 2.8E-05 /yr

The external events represent about 43% of the total core damage frequency as follows:

Initiating Events Frequency Seismic 1.1E-05 /yr Tornado 6.5E-06 /yr Fire 2.9E-06 /yr Total External 2.1E-05 /yr

A review of the detailed distribution shows that the leading contributor to the total core damage frequency are the seismic initiators.

9 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

4.2 Identification Of Potential SAMAs

The process of identifying a preliminary list of potential severe accident sequences for consideration of additional alternatives makes use of the most recent update of the McGuire PRA Level 1 results. The McGuire PRA Revision 2 report lists the top 100 cut sets (severe accident sequences) based on internal initiators and a top 100 list of cut sets for external initiators ranked by contribution to total core damage frequency. This list of 200 severe accident sequences includes all potential core damage accident sequences with at least a 0.06% contribution to the total core damage frequency. Therefore, this list will be the starting point for identifying which severe accident sequences contribute the most to the core damage frequency for McGuire, which may need to be considered for additional SAMAs.

As previously stated, the preliminary list of 200 internal and external cut sets contain severe accident sequences contributing at least 0.06%. Additionally, some cut sets contributing as little as 0.05% to the total core damage frequency are also included. This is a comprehensive list of potential severe accident sequences identified for the McGuire plant. Furthermore, most of the accident sequences contained in this listing are very small contributors to the total core damage frequency (< 1%), indicating that little benefit can be gained in reducing the core damage frequency for these sequences. For this analysis, a core damage frequency cutoff value of 3.5E-07 (for internal and external initiators) is applied as a method of screening out those severe accident sequences for consideration of SAMAs. It is assumed that the implementation of alternatives for sequences with core damage frequency contributions below these cutoff values will provide low or marginal benefit. This assumption is conservative because there are no SAMAs identified as cost-beneficial to implement for the cut sets above this cutoff value, and it is expected this will be the case for the cut sets below this cutoff value.

4.3 Analysis Of Potential SAMAs

The approach selected for this portion of the analysis (potential SAMAs to reduce core damage frequency) is to calculate the value of the total averted risk (including averted public exposure, averted onsite cleanup cost, averted onsite exposure risk, and averted offsite property damage) for each alternative. It relies on the NRC’s Regulatory Analysis Guide [Reference 4.1] to convert public health risk (person-rem) into dollars to estimate the cost of the public health consequences. The requirement established in this guide is to use $2000 per person-rem to convert public heath consequences to dollars (not indexed to inflation).

This analysis divides the potential severe accident sequences for consideration of SAMAs into two sections: (1) seismic initiator sequences, and (2) non-seismic initiator sequences.

10 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

Seismic Initiators

In the McGuire IPEEE study, the seismic analysis was conducted by considering a distribution of equipment failure probabilities over various earthquake levels. The IPEEE analysis generates many cut sets that are grouped into particular plant damage states (PDSs). Therefore, the seismic initiator cut sets given in Table 6.1.3-2 of Reference 3.1 are the total probability of the cut sets in each PDS category rather than the individual cut set probabilities as in the case of the non-seismic events.

The following paragraphs explain how the McGuire-specific parameters are derived in order to calculate the total averted cost for the seismic initiator severe accident sequences.

Averted Public Exposure (APE)

The McGuire PRA Level 2-3 analysis maps each seismic initiator PDS into the various containment failure modes and release categories, and then presents the public health risk (person-rem) on a frequency weighted basis. The estimated maximum amount of annual person-rem risk associated with a particular seismic initiator cut set is calculated from the person-rem risk and core damage frequency for the PDS attributable to the seismic initiator. For example, the “seismic initiator causes PDS 7PI” severe accident sequence core damage frequency is estimated to be 9.6E-06 per year. The public health risk results from the Level 3 analysis estimates the conditional person-rem risk for PDS 7PI to be 3.7E+05 person-rem. Therefore, the total person-rem risk attributable to the “seismic initiator causes PDS 7PI” is determined by multiplying the core damage frequency for PDS 7PI by the conditional person-rem for PDS 7PI. This is demonstrated below:

Total Person-rem Risk = 9.6E-06 yr-1 × 3.7E+05 person-rem = 3.6 person-rem/yr

Some risk will always exist, even when increasing the seismic ruggedness of many plant components/systems, because there is no way to completely eliminate the risk associated with seismic events. However, for this analysis an assumption is made that the implementation of plant enhancements for seismic events will completely eliminate the risk. The following equation is used to determine the value of the averted risk to the public:

Value Of Averted Risk = ($2000/person-rem) × (Total Person-rem Risk)

The above equation calculates the value of averted risk on an annual basis. Therefore, a method of “discounting” is used to calculate the “present value” or “present worth of averted risk” based on a specified period of time. For this analysis, a discount factor of 7% as described in the NRC Regulatory Analysis Technical Evaluation Handbook [Reference 4.2] is used to determine the present worth of averted risk over the 20 year license renewal period for McGuire. This results in a multiplication factor of approximately 11:

11 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

Averted Public Exposure = (11) × ($2000/person-rem) × (Total Person-rem Risk)

Therefore, averted public exposure is calculated using the following equation:

APE for 20-year license renewal period = $2.20E+04 * (Change in annual Risk) (Eq. 4-1)

Averted Onsite Cleanup Cost (ACC)

The estimated cleanup and decontamination cost for severe accidents is $1.5 billion (from NUREG/BR-0184 page 5.42). This cost is the sum of equal costs over a 10-year cleanup period. At a 7% discount rate, the present value of this stream of costs is $1.1 billion.

The net present value of cleanup and decontamination over the license renewal period is estimated from (equation from NUREG/BR-0184 page 5.43):

UCD = [$1.1E+09/0.07][1 – exp(-0.07 * 20)]

UCD = $1.18E+10

Then,

ACC for 20-year license renewal period = $1.18E+10 * (Change in annual CDF) (Eq. 4-2)

Averted Onsite Exposure Cost (AOE)

Assume a discount rate of 7% over the 20-year license renewal period.

Immediate Dose (see NUREG/BR-0184 pages 5.30 – 5.33)

WIO = $2000/person-Rem * 3300 person-Rem * [1 – exp(-0.07 * 20)]/0.07 * (Change in CDF) where, 3300 person-Rem = best estimate (from NUREG/BR-0184 page 5.30)

WIO = $7.10E+07 * (Change in annual CDF)

Long-Term Dose (see NUREG/BR-0184 pages 5.31 – 5.33)

WLTO = $2000/person-Rem * 20,000 person-Rem *[(1 - exp(-0.07 * 20))/0.07] * [(1 - exp(-0.07 * 10))/(0.07 * 10)] * (Change in CDF) where, 20,000 person-Rem = best estimate (from NUREG/BR-0184 page 5.31) Assume the doses accrue over a 10-year period

WLTO = $3.10E+08 * (Change in annual CDF)

12 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

AOE = WIO + WLTO = ($7.10E+07 + $3.10E+08) * (Change in annual CDF)

AOE for 20-year license renewal period = $3.81E+08 * (Change in annual CDF) (Eq. 4-3)

Averted Offsite Property Damage Cost (AOEC)

In 1990 dollars ≈ $2.46E+08 (assumed from NUREG/BR-0184 Table 5.6 on page 5.38)

Inflating to the year 2000 dollars ≈ $3.64E+08 (assume 4% inflation)

Assume a 7% discount rate for the 20-year license renewal period

AOEC = [$3.64E+08/0.07][1 – exp(-0.07 * 20)] * (Change in CDF)

AOEC for 20-year license renewal period = $3.92E+09 * (Change in annual CDF) (Eq. 4-4)

The above methodology is repeated for each of the remaining seismic initiator severe accident plant damage listed in the top 100 external cut sets [Table 6.1.3-2 of Reference 3.1]. The results are presented in Table 4-1.

Considering that the averted risk value is approximately $275,000 (see Table 4-1), the risk reduction achievable is indeed small and that the cost of substantial upgrades in the plant systems seismic ruggedness is very large (at least several million dollars). Therefore, seismic related SAMAs are eliminated from further consideration.

Non-Seismic Initiators

The following paragraphs explain how the McGuire-specific parameters are derived, in order to calculate the averted cost to the public for the non-seismic initiators.

The non-seismic initiator severe accident sequences (cut sets) contain basic events modeling the different types and combination of failures related to the severe accident sequence. Since most of the alternatives under consideration in this analysis have the potential to impact more than one severe accident sequence, it is necessary to determine the cumulative risk reduction achievable by each SAMA. This is performed by identifying which basic events in the cut sets would be affected by the implementation of a particular SAMA and conservatively assuming that the basic event(s) would be completely eliminated by the SAMA. The resulting change in core damage frequency from setting the basic event(s) to a value of zero provide the maximum risk reduction for that particular SAMA. For example, the basic event TRECIRCDHE (operators fail to establish high pressure recirculation following a LOCA) is associated with several “LOCA cut sets with failure of operators to initiate high pressure recirculation”. Since several severe accident sequences have the potential to be impacted by the

13 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis implementation of the alternative (automatic swap over to high pressure recirculation), an assumption is made to set the basic event TRECIRCDHE to zero to determine the maximum core damage frequency reduction achievable. In this case the maximum core damage frequency reduction from implementing the SAMA is 1.0E-05 per year. This new cut set file is used to generate a new conditional probability matrix, which is then processed through the PRA Level 3 risk analysis to estimate the new person-rem risk. This new person-rem risk is subtracted from the base case person-rem risk (13.5 person- rem) to determine the maximum risk reduction achievable. For the example of the TRECIRCDHE event the new person-rem risk is estimated to be 13.1 person-rem. Therefore, the maximum risk reduction for this SAMA is estimated to be 0.4 person-rem (13.5 minus 13.1).

Some risk will always exist, even when implementing an alternative, because the system is not expected to be 100% reliable. However, for this analysis an assumption is made that the implementation of an alternative for a severe accident sequence will completely eliminate the risk. The equations presented above (Eq. 4-1 through Eq. 4-4) are used here to determine the “Present Worth Of Averted Risk”. These values represent the upper limit of “averted risk”. Table 4-2 provides a list of the seven SAMAs considered to reduce core damage frequency, total person-rem risk, and present worth of averted risk calculated for each candidate applying the method discussed above.

As seen from Table 4-2, the seven potential SAMA candidates have a present worth of averted risk in the range of $18,000 to $250,000. The cost to implement most of the alternatives listed in Table 4-2 for McGuire will be greater than $1 million, based on the review of other industry cost estimate studies [Reference 4.3] applicable to McGuire. Comparing these cost estimates to the present worth of averted risk presented in Table 4- 2, shows that the cost to implement most of these alternatives will far exceed the present worth averted risk. However, for two potential SAMAs listed in Table 4-2:

1. install third diesel, and 2. increase test frequency of Standby Makeup Pump flow path (currently tested quarterly) cost estimates have been performed for McGuire (see Section 4.4) to determine whether or not the alternative is cost-beneficial. There are two reasons why these alternatives are selected for McGuire-specific cost estimates. First, there is no readily available information on estimated cost to implement similar types of alternatives; and second, the basic events associated with these alternatives are seen to have a Fussell-Vesely (F-V) importance measure of several percent, as seen from Table 6.1.3-3 of Reference 3.1.

14 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

Basic Event Importance Ranking

This portion of the analysis presents another approach to identifying potential SAMAs beyond those selected from evaluating the cut set listings. This involves (1) reviewing the basic event importance ranking list [Table 6.1.3-3 of Reference 3.1] for events of significant F-V values, which are not captured in Table 4-2, and (2) identifying any additional SAMAs that could be implemented to reduce the core damage frequency contribution from these events. This will provide a more complete review of potential SAMAs, which should be considered, for implementation.

A review of the importance ranking of the basic events reveals that two external initiating events (seismic and tornadoes) contribute significantly to the core damage frequency. Since seismic and tornado initiators are acts of nature, their frequency of occurrence cannot be reduced.

For the initiating event “Loss of RN” the core damage frequency contribution due to a total loss of Nuclear Service Water (RN) is obtained from a fault tree solve. The fault tree solve for this initiator generated a large number of cut sets representing numerous combinations of equipment/ operator failures. Based on a review of these cut sets and the various types of failures contained in these cut sets, a possible way of reducing the frequency of this event occurring is to install a third train of RN. Obviously, the cost to perform this modification will far exceed the benefit of core damage frequency reduction.

Another initiating event showing up as important in the importance ranking is “Vital I&C Fire Causes a Loss of RN”. This initiating event results in a failure of electrical cables for both trains of RN pumps. The IPEEE fire analysis looked at ways to reduce the plant’s vulnerability to fire initiating events. The results of the IPEEE analysis states that there are no unacceptable risks or outliers identified by the IPEEE fire protection walkdown. Duke Energy continues to place emphasis on the control of combustible materials, workers awareness of jobs that may present a fire hazard, and adequate fire protection. In addition, McGuire has three potential ways of mitigating this type of initiating event: (1) use backup cooling from the Containment Ventilation Cooling Water (RV) System, (2) cross-connect to other unit RN system, and (3) use the SSF.

Furthermore, the importance ranking shows that the “Loss of Offsite Power - LOOP” initiator contributes significantly to the core damage frequency. A lot of work has already been done as a result of the original McGuire PRA to address the LOOP initiator. Enhancements to the station blackout procedures and operator training have been implemented to reduce the likelihood and consequences of LOOPs. Duke continues, through the PRA update process, to investigate other improvements that can be made to further reduce the risk significance of these events.

Another initiating event showing up as important in the importance ranking is turbine building fire. The IPEEE fire analysis looked at ways to reduce the plant’s vulnerability to fire initiating events. Numerous recommendations from the fire analysis have been

15 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis made to improve fire protection and reduce the chance of a fire occurring. Duke continues to place emphasis on the control of combustible materials, workers awareness of jobs that may present a fire hazard, and adequate fire protection.

Duke has and continues to investigate ways of reducing the frequency of initiating events and mitigating the potential damages associated with such events. Based on the findings of these investigations, plant enhancements that could reduce the impact of such events have been implemented where reasonably possible. (See Table 2.1)

The remaining basic events listed in the importance table [Reference 3.1], were reviewed for potential SAMAs. Duke determined that the cost to implement any alternatives to mitigate or eliminate the consequences of the events would far exceed the averted risk benefit. Therefore, no additional SAMAs are considered for implementation.

4.4 Cost-Benefit Analysis For Selected SAMAs

In Section 4.3 two alternatives were identified for detailed cost estimate analyses due to the lack of information on the cost of implementation and the basic event importance measure associated with these alternatives. The selected alternatives are: (1) Install third diesel, and (2) Increase test frequency of Standby Makeup Pump flow path – currently tested on quarterly basis.

Therefore, the purpose of this portion of the analysis is to perform a cost-benefit analysis on the selected alternatives identified above, using McGuire-specific cost estimates.

Install third diesel

A design alternative that could reduce the core damage frequency associated with loss of offsite power events is to install a third diesel. In September 1995 a design study was performed to evaluate the costs associated with adding an alternative AC power source (installing a third diesel) at McGuire and Catawba. In this design study the cost estimate includes engineering, equipment and material, contracts, and installation craft resources (along with O&M costs). The results of the cost estimate analysis to install a third diesel is approximately $2 million. Therefore, the cost of implementing this alternative will far out weigh the benefit of averted risk worth (maximum benefit for this alternative is ~$200,000 from Table 4-2) making this alternative cost prohibitive.

Increase test frequency of Standby Makeup Pump flow path

The current test frequency of the Standby Makeup Pump flow path is quarterly. From the McGuire PRA results, the filter restricting flow due to clogging dominates this flow path failure. The failure rate of this filter is obtained from a generic type code failure rate, which is believed to be much higher than the true failure rate for the Standby Makeup Pump filter. The failure rate developed for the type code data base is for a system with

16 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis continuous raw water flow through a filter. The Standby Makeup Pump system does not operate continuously; therefore, since flow is not continuously passing through the filter and the water contained in the Standby Makeup Pump system is clean water, the failure rate of this filter due to clogging is expected to be much less than the type code value. However, if the test frequency for this flow path is increased from quarterly to monthly, then the exposure time is reduced significantly in the event of the filter clogging and the likelihood of the filter restricting flow could be mitigated due to early detection of any potential clogging problems. The results of the cost estimate analysis to increase the test frequency of the Standby Makeup Pump flow path is approximately $435,000 (over the 20-year license renewal period). Therefore, the cost of implementing this alternative will far out weigh the benefit of averted risk worth (maximum benefit of this alternative is ~$40,000 from Table 4-2) making this alternative cost prohibitive.

17 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

TABLE 4-1 Top 4 Seismic Initiator Severe Accident Sequences

Seismic Initiator Change in Averted Averted Averted Averted Offsite Total Severe Accident Change in Person-rem Risk Public Onsite Onsite Property Present Sequences CDF (yr-1) Exposure Cleanup Costs Exposure Damage Worth Seismic initiator causes 3.6 PDS 7PI 9.6E-6 (9.6E-06 yr-1 × 3.7E+05 $7.9E+04 $1.1E+05 $3.7E+03 $3.8E+04 ~ $2.3E+05 person-rem)

Seismic initiator causes 0.5 PDS 7DI 1.5E-6 (1.5E-06 yr-1 × 3.4E+05 $1.1E+04 $1.8E+04 $5.7E+02 $5.9E+03 ~ $3.5E+04 person-rem)

Seismic initiator causes < 0.1 PDS 7PL 9.6E-8 (9.6E-08 yr-1 × 2.2E+05 < $2.2E+03 $1.1E+03 < $1.0E+02 $3.8E+02 < $4.0E+03 person-rem)

Seismic initiator causes < 0.1 PDS 7LI 7.3E-8 (7.3E-08 yr-1 × 3.0E+05 < $2.2E+03 $8.6E+02 < $1.0E+02 $2.9E+02 < $4.0E+03 person-rem)

TOTAL ≈ 4.1 person-rem $ 275,000

18 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

TABLE 4-2 Top 7 SAMAs Considered To Reduce CDF SAMA Change in Averted Averted Cost of # Potential Alternative Severe Accident Sequences Change Total 1 Averted Onsite Averted Offsite Total Alternative (Basic Event) in CDF Person- Public Cleanup Onsite Property Present (2001 (yr-1) rem Risk Exposure Costs Exposure Damage Worth2 dollars) Man Standby Shutdown Facility (SSF) 24 hours a • Loss of RN, failure of operators to align SSF for operation, filter day with a trained operator (Standby Makeup Pump) restricts flow, failure to align RV Cooling/other Unit RN This SAMA would eliminate the time factor • Vital I&C Fire causes a Loss of RN, failure of operators to align SSF associated with an operator being dispatched to the for operation, failure to use other Unit or remote control during fire 1 SSF. Therefore, for this analysis it is assumed that • Loss of 4160V Essential Bus and failure to align SSF for operation 1.1E-5 3.2 $7.0E+04 $1.3E+05 $4.2E+03 $4.3E+04 $2.5E+05 >$5 M the DHE events associated with the operators (NNVSSFADHE) failing to align SSF for operation in time are AND completely eliminated since there would be no transition time associated with dispatching an • Tornado causes LOOP, DG 1A and 1B fail to fun, operators fail to operator to start the SSF. initiate SS Sys. operation (NNVSSFBDHE)

Install automatic swap over to high pressure LOCA cut sets with failure of operators to establish high pressure recirculation recirculation. (TRECIRCDHE) 2 1.0E-5 0.4 $8.8E+03 $1.2E+05 $3.8E+03 $3.9E+04 $1.7E+05 >$1 M This SAMA would eliminate the operator action required for manual swap over – DHE event.

Install automatic swap to RV Cooling/other Unit Loss of RN, failure of operators to align SSF for operation, filter (Standby RN system upon loss of RN Makeup Pump) restricts flow, failure to align RV Cooling/other Unit RN 3 (RNUNIT2RHE) 8.8E-6 1.2 $2.6E+04 $1.0E+05 $3.4E+03 $3.4E+04 $1.7E+05 >$1 M This SAMA would eliminate the operator action required to manually align backup cooling to NV pumps.

Install third diesel Tornado causes LOOP, DG 1A and 1B fail, and operators fail to initiate SS Sys. operation 4 For this SAMA it is assumed that failures (JDG001ADGR + JDG001BDGR + JDG001ADGS + JDG001BDGS + 8.4E-6 3.1 $6.8E+04 $9.9E+04 $3.2E+03 $3.3E+04 $2.0E+05 >$2 M associated with the two diesels already installed JDG1ARNCOM) (run, start and common cause failures) would be eliminated.

Install automatic swap to other Unit Vital I&C Fire causes a Loss of RN, failure of operators to align SSF for 5 operation, failure to use other Unit or remote control during fire 2.9E-6 1.1 $2.4E+04 $3.4E+04 $1.1E+03 $1.1E+04 $7.1E+04 >$1 M (FIREFLDRHE)

Increase test frequency of Standby Makeup Pump Loss of RN, failure of operators to align SSF for operation, filter (Standby 6 flow path (currently tested quarterly) Makeup Pump) restricts flow, failure to align RV Cooling/other Unit RN 1.8E-6 0.5 $1.1E+04 $2.1E+04 $6.9E+02 $7.1E+03 $4.0E+04 >$ 0.4 M (NNVSMUPFLF)

Replace reactor vessel with stronger vessel Failure of reactor pressure vessel with failure to prevent core damage 7 following an reactor pressure vessel failure 1.0E-6 < 0.1 < $2.2E+03 $1.2E+04 $3.8E+02 $3.9E+03 <$1.8E+04 >$1 M (RPV)

1 Total Person - risk includes internal and external (non-seismic) events 2 The Total Present Worth values are calculated from an external spreadsheet and may different slightly when performing hand calculations due to round off.

19 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

5.0 SAMAs Considered For Person-rem Risk Reduction

5.1 McGuire Person-rem Risk Profile

In the event of a severe accident, a certain amount of person-rem risk would be associated with various types of containment failure. The containment failure modes of concern are those that have the potential for early release of fission products to the public such as early containment failures, isolation failures, and containment bypass (steam generator tube rupture – SGTR, and interfacing systems LOCA - ISLOCA).

The McGuire PRA Level 1/2 results presented in this analysis are from the current McGuire PRA (Revision 2). The results of the current McGuire PRA Level 2 analysis show that the most likely containment failure mode is relatively benign failure by late containment failure. This containment failure mode occurs many hours after core melt has occurred allowing time for mitigative actions to be taken such as recovering vital pieces of equipment for core debris cooling and containment heat removal, and implementing evacuation strategies. For the McGuire containment the conditional probability of having an early release of fission products to the public from early containment failures, isolation failures, and containment bypass following a severe accident is estimated to be less than 9%.

The McGuire PRA Level 3 results are updated for this analysis using a different consequence analysis computer code, more recent meteorological data, and projected population estimates as described below. For this analysis, the McGuire severe accident person-rem risk results were generated with the MACCS2 (MELCOR Accident Consequence Code System – Reference 5.1) computer code. The plant-specific input to the MACCS2 code includes McGuire core radionuclide inventory, emergency response evacuation modeling based on the McGuire evacuation time estimate studies, release category source terms from the McGuire PRA Rev. 2 analysis, site meteorological data (1999 met data), and projected population distribution (within 50-mile radius) for the year 2040. The McGuire annual person-rem risk result from the MACCS2 code for the 50 mile population is 13.5 whole body person-rem. The internal events account for approximately 6.0 whole body person-rem per year at 50 miles. The external events account for approximately 7.5 whole body person-rem per year at 50 miles. For external events, the major source of risk is seismic which is dominated by postulated earthquakes with accelerations (0.3g - 0.5g) much greater than the design basis earthquake. In general, the risk measures calculated show very low risk for the health and safety of the public.

20 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

5.2 Identification Of Potential Containment-Related SAMAs

For this portion of the analysis, other industry studies were used to obtain a preliminary list of containment improvement alternatives to be considered for McGuire. The Watts Bar SAMDA analysis [Reference 4.3] identified several potential alternatives that would enhance the ability of the containment to withstand challenges associated with late hydrogen burn, late overpressurization, basemat melt through, and containment bypass. The following nine design changes were identified for the Watts Bar analysis:

1. Install deliberate ignition system - provide an AC- and DC-independent system to burn combustible gases generated in containment during a severe accident to eliminate containment failures due to hydrogen combustion. 2. Install reactor cavity flooding system - provide the capability to flood the reactor cavity of the containment to reduce the possibility of direct core debris contact with containment. 3. Install filtered containment vent system - provide the capability to vent the containment to an external filter to reduce the frequency of and consequences of late containment failures. 4. Install core retention device - to prevent direct impingement of core debris onto the containment during a high pressure melt ejection. 5. Install containment inerting system - to inert the containment atmosphere to prevent combustion of hydrogen and carbon monoxide during severe accidents. 6. Install additional containment bypass instrumentation - install additional pressure- monitoring instrumentation between the first two isolation valves on low-pressure injection lines, residual heat removal suction lines, and high-pressure injection lines. This would improve the ability to detect leakage or open valves, which decrease the frequency of interfacing systems LOCA (ISLOCAs). 7. Install reactor depressurization system - provides capability to rapidly depressurize the reactor coolant system to reduce the threat of high pressure melt ejection and allow injection from low pressure systems. 8. Install independent containment spray system - provides a redundant containment spray system. 9. Install AC-independent air return fan power supplies - provides a redundant power supply to air return fans.

The following five additional alternatives considered for containment performance improvement were obtained from NUREG-1560 [Reference 5.2]:

10. Add procedures for direct reactor coolant system depressurization to prevent early containment failure associated with reactor vessel breach at high reactor coolant system pressure. 11. Add emphasis on isolation procedures in operator training.

21 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

12. Add procedures to cope with and reduce induced steam generator tube rupture (SGTR). 13. Add alternative, independent source of feedwater to reduce induced SGTR. 14. Add emphasis on increasing the likelihood of maintaining a coolable debris bed to prevent late containment failure due to overpressurization.

Combining the information gathered from the two studies mentioned above provides a preliminary list of 14 containment performance improvement alternatives to be considered for McGuire.

The following is the process used to refine the list of 14 containment performance improvement alternatives identified for consideration at McGuire:

• identify any alternatives that have already been implemented at McGuire, and • identify any alternatives that are not applicable to McGuire’s containment.

The current McGuire procedures satisfy the intent of Alternatives 10 and 11. Following the IPE study the plant procedure was modified to address the induced SGTR (Alternative 12). A significant part of the Severe Accident Management Guidance Program (SAMG) at McGuire emphasizes the importance of and provides guidance to the operators on depressurizing the reactor coolant system to prevent high pressure melt ejection. Also, the SAMG program provides guidance on putting water into the containment using plant resources to increase the likelihood of maintaining a coolable debris bed in the event of a severe accident. Thus Alternative 14 has been addressed through the SAMG program.

The alternative to “install reactor depressurization system” (Alternative 7) is for a plant that has limited reactor coolant system depressurization capability. McGuire has three PORVs located on the pressurizer, which provides sufficient depressurization of the reactor coolant system to pressures low enough to prevent high pressure melt ejection. Also, the SAMG program provides guidance on using the pressurizer PORVs to depressurize the reactor coolant system rapidly to prevent high pressure melt ejection. The estimated cost to install an additional reactor depressurization system from other studies is on the order of several million dollars [Reference 4.3]: therefore, this alternative is eliminated from further consideration in this analysis since very little benefit will be gained from the implementation of this alternative.

Thus, the preliminary list of 14 containment performance improvement alternatives considered for McGuire is reduced to nine potential candidates for cost-benefit analysis. The following section discusses the method used to determine if any of these nine alternatives are cost-beneficial to implement for the McGuire containment.

22 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

5.3 Analysis Of Potential Containment-Related SAMAs

The method used in this portion of the analysis is similar to the one presented in Section 4.3.

The following explains how the McGuire-specific parameters are derived in order to calculate the averted cost to the public based on implementation of containment performance improvements. The McGuire PRA Level 3 analysis calculates the estimated person-rem risk associated with each type of containment failure mode following a severe accident. As can be seen in Table 5-1, the results of the McGuire PRA analysis show that there are three containment failure modes contributing more to the annual person-rem risk than any of the other potential failure modes (ISLOCA – 2.6 person-rem, Early Containment failures - 5.5 person-rem, and Late Containment failures – 5.3 person-rem). These are evaluated in detail below.

The PRA Level 3 analysis reveals that almost all of the large early release frequency (LERF) is attributable to the ISLOCA initiator. The dominant ISLOCA initiator sequences involve the failure of at least two valves (i.e., valve ruptures, transfers position, operator error, etc.). The total CDF and person-rem risk associated with the ISLOCA initiators is 2.2E-07 per year and 2.6 person-rem, respectively. The estimated cost to implement additional containment bypass instrumentation is on the order of several million dollars [from Reference 4.3]. For this analysis if the assumption is made that the implementation of a containment performance improvement alternative will completely eliminate the ISLOCA risk, the total averted risk value is $61,000 (applying Eq. 4-1 through Eq. 4-4 of Section 4.3 – APE = 11 * $2000 * 2.6 person-rem/yr = $57,200, and ACC, AOE, AOEC = 2.2E-7 per yr * [$1.18E+10 + $3.81E+08 + 3.92E+09] = $3542). Therefore, the estimated cost to implement additional containment bypass instrumentation to detect ISLOCAs far exceeds the theoretical maximum present worth of averted risk making the alternative very cost prohibitive even if McGuire’s actual cost is significantly less than the referenced estimate.

From the McGuire PRA results, the containment isolation failure mode is dominated by loss of offsite power events. These sequences involve loss of power to motor-operated containment isolation valves and would require manual action to close the valve outside containment. The only feasible containment performance improvement alternative considered for this type of containment failure mode is adding emphasis on isolation procedures in operator training. This has already been implemented at McGuire per the McGuire IPE study.

The late containment failure mode for the McGuire plant is associated with sequences where containment sprays are lost and no recovery is possible. This leads to a buildup of pressure from steam and non-condensible gases over many hours until the containment fails. A containment performance improvement alternative that could reduce the person- rem risk associated with such failures is the installation of an independent containment

23 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis spray system. From Reference 4.3 the estimated cost to implement such an alternative will be at least several million dollars. The present worth of averted risk for implementation of this alternative is estimated by assuming all 5.3 person-rem risk is eliminated for late containment failures. Then multiplying the 5.3 person-rem risk by $2000/person-rem yields an estimated averted risk value of $10,600, and multiplying this value by the discount multiplication factor of 11 gives an estimated present worth of $117,000. Therefore, based on the cost to implement this alternative this containment performance improvement will cost far more to implement than the value of the averted risk. Some benefit in reducing the early containment failure may be seen from this alternative but this would be expected to be small compared to the late containment failure benefit.

Furthermore, when considering the implementation of alternatives, it is important to evaluate the potential negative impacts of implementing alternatives as well as the positive benefits. For example, the containment performance improvement alternative considered in Table 5-1 (installing a reactor cavity flooding system) is intended to reduce the likelihood of basemat melt through by flooding the core material after reactor vessel failure. Even though the implementation of this alternative may reduce the likelihood of basemat melt through, any potential negative consequences have not been investigated.

Table 5-1 provides a list of the nine selected containment performance improvement alternatives considered for implementation at McGuire along with the percentage of the time a containment failure mode may occur given a severe accident, the total person-rem and present worth of averted risk estimates associated with each containment failure mode.

As seen from Table 5-1, the nine potential containment-related SAMAs have an averted risk worth in the range of $2200 to $121,000. The cost to implement any of the containment performance improvement alternatives listed in Table 5-1 for McGuire will range anywhere from a few million dollars to tens of millions of dollars based on the review of other industry cost estimate studies [Reference 4.3]. Comparing these cost estimates to the averted risk worth presented in Table 5-1 reveals that the cost to implement these alternatives will far exceed the averted risk worth. This conclusion applies even for those alternatives providing benefit to more than one type of containment failure mode.

For example, the six alternatives (install independent containment spray system, filtered containment vent, backup power to igniters, reactor cavity flooding system, backup power to air return fans, and containment inerting system) provide some benefit to more than one type of containment failure mode. As stated earlier, the installation of an independent containment spray system provides more late containment failure benefit than early containment failure benefit. But if this alternative is assumed to completely eliminate late and early containment failures, the cost of implementation would far exceed the averted risk value of ($117,000 + $121,000). This same conclusion is applied to each of the filtered containment vent alternative, backup power to igniters alternative,

24 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis backup power to air return fans alternative, and containment inerting system alternative based on the cost of implementation versus the total averted risk value for early and late containment failures ($117,000 + $121,000). The cost to implement most of the alternatives listed in Table 5-1 for McGuire will be greater than $1 million, based on the review of other industry cost estimate studies [Reference 4.3] applicable to McGuire. Comparing these cost estimates to the present worth of averted risk presented in Table 5- 1, shows that the cost to implement most of these alternatives will far exceed the present worth averted risk. However, for one potential SAMA listed in Table 5-1 (install reactor cavity flooding system) a cost estimate has been performed for McGuire (see Section 5.4) to determine whether or not the alternative is cost-beneficial.

5.4 Cost-Benefit Analysis For Containment-Related SAMAs

In Section 5.3 one alternative was identified for a McGuire-specific cost estimate analysis due to the lack of information on the cost of implementation and the potential containment performance improvement associated with this alternative. The selected alternative is: Install standpipe in containment for reactor cavity flooding.

Therefore, the purpose of this portion of the analysis is to perform a cost-benefit analysis on the selected alternative identified above, using McGuire-specific cost estimates.

Install Standpipe in Containment for Reactor Cavity Flooding

The accident mitigation goal associated with flooding the reactor cavity is to provide cooling to the core debris (invessel and exvessel). The current spill over elevation for water to enter the reactor cavity/incore instrumentation room from the containment sump at McGuire is approximately 13 feet. This elevation is at the reactor coolant system piping penetrations in the primary shield wall. The water volume necessary to increase the McGuire containment sump level to the spill over point of 13 feet and flood the reactor cavity is equivalent to two refueling water storage tank (FWST) volumes (~750,000 gallons). Therefore, prior to reactor vessel failure there are two options available for achieving this accident mitigation goal: (1) inject the initial FWST volume into containment and refill the FWST and inject that volume into containment, and (2) inject all available water sources into containment (i.e., FWST volume, cold leg accumulators, reactor coolant system volume, and ice). If an open standpipe is installed in the containment sump floor that allows water to spill over into the reactor cavity at an elevation much less than the current 13 foot elevation, but still maintain net positive suction head pump requirements for swap over to recirculation, then the likelihood of flooding the reactor cavity is increased. The results of the cost estimate analysis to install a standpipe in containment is at least $1 million. The maximum benefit from implementation of this alternative is estimated by assuming that early containment failures and basemat melt through are completely eliminated. From Table 5-1 this benefit is estimated to be ~$123,000 ($121,000 + $2200). Therefore, the cost of implementing

25 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis this alternative will far out weigh the benefit of averted risk worth making this design alternative cost prohibitive.

26 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

TABLE 5-1 Potential Containment SAMAs Considered To Reduce Person-rem Risk

Percentage Of Time Total Present Containment Failure Potential Containment Severe Accidents Will Person-rem Worth Of Mode (CFM) Performance Alternatives To End In Particular Risk Averted Risk Mitigate CFM CFM Late Containment Failures 1. Install independent containment spray system 2. Install filtered containment vent system 5. Install backup power to igniters 41 % 5.3 $117,000 8. Install backup power to air return fans 9. Install containment inerting system

Containment Bypass 3. Install additional containment 2.6 – ISLOCA $61,000 ISLOCA bypass instrumentation (ISLOCA) (ISLOCA) < 1 % (ISLOCA and SGTR SGTR 4. Add independent source of combined) feedwater to reduce induced < 0.1 – SGTR < $2200 SGTR (SGTR)

1. Install independent containment spray system Early Containment Failures 2. Install filtered containment vent system 5. Install backup power to igniters 7 % 5.5 $121,000 6. Install reactor cavity flooding system 8. Install backup power to air return fans 9. Install containment inerting system

6. Install reactor cavity flooding Basemat Melt Through system 5 % < 0.1 < $2200 7. Install core retention device

27 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

6.0 Overall Results

Duke has evaluated potential plant enhancements that would further reduce the probability of severe accidents and the associated person-rem risk. The incremental safety benefit of implementing these plant enhancements has been analyzed by performing a public risk analysis. The results of the public risk analysis show that none of the hardware changes for severe accident mitigation alternatives considered for core damage frequency and person-rem reduction would be cost-beneficial to implement at McGuire. Most of the alternatives considered are associated with severe accident sequences of either low contribution to core damage frequency (< 5% of the total) or low risk (< 3 person-rem). From the results obtained, it is apparent that the dominant severe accident sequences are seismic initiators based on their total contribution to core damage frequency and person-rem risk. However, even the alternatives considered for these type initiators are found to be cost prohibitive because the cost to implement the alternatives far exceed the value of the public health risk averted.

In addition, Duke recently implemented two programs to manage the risk associated with severe accidents. The Maintenance Rule Program is currently aiding in identifying risk significant structures, systems and components to minimize failures that are maintenance preventable. Most recently, Duke’s implementation of the Severe Accident Management Guidance (SAMG) Program provides guidance on arresting core damage and mitigating fission product releases to the public in the event of a severe accident. Some of the severe accident management guidance provided by the SAMG program include:

• depressurizing the reactor coolant system prior to reactor vessel failure, thus preventing a high pressure melt ejection and SGTRs, • venting containment prior to containment failure due to overpressurization (controlled release versus an uncontrolled release of fission products), • inject water into reactor building (containment) to cool core debris, etc.

The following table summarizes the severe accident mitigation alternatives and containment performance improvements considered for McGuire and the status of implementation:

28 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

TABLE 6-1 Summary Of Potential Alternatives Considered For McGuire To Reduce Core Damage Frequency & Person-rem Risk

Potential Alternative Implemented or Reason Not Implemented Not Implemented Increase seismic ruggedness of many plant Not Implemented Not Cost Beneficial. The risk reduction components/systems achievable is small and that the cost of substantial upgrades in the plant systems seismic ruggedness is very large

Install automatic swap over to high Not Implemented Not cost beneficial. Very expensive with pressure recirculation extremely small impact on public health risk

Install third diesel Not Implemented Not cost beneficial. Very expensive with extremely small impact on public health risk

Man SSF 24 hours a day with a trained Not Implemented Not cost beneficial. Very expensive with operator extremely small impact on public health risk

Install auto swap over to RV Cooling/other Not Implemented Not cost beneficial. Very expensive with Unit RN System upon loss of RN extremely small impact on public health risk

Install automatic swap over to other Unit Not Implemented Not cost beneficial. Very expensive with extremely small impact on public health risk

Replace reactor vessel with stronger vessel Not Implemented Not cost beneficial. Very expensive with extremely small impact on public health risk

Increase test frequency of Standby Makeup Not Implemented Not cost beneficial. Very expensive with Pump flow path from quarterly testing to extremely small impact on public health risk monthly testing

Install additional containment bypass Not Implemented Not cost beneficial. Very expensive with instrumentation (ISLOCA) extremely small impact on public health risk. SAMG Program addresses this issue.

Add independent source of feedwater to Not Implemented Not cost beneficial. Very expensive with reduce induced SGTR extremely small impact on public health risk

Install backup power to igniters Not Implemented Not cost beneficial. Very expensive with extremely small impact on public health risk

Install backup power to containment air Not Implemented Not cost beneficial. Very expensive with return fans extremely small impact on public health risk

Add procedures for direct RCS Implemented Existing procedures adequate depressurization

Add emphasis on isolation procedures in Implemented Existing procedures adequate operator training

29 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

TABLE 6-1 Summary Of Potential Alternatives Considered For McGuire To Reduce Core Damage Frequency & Person-rem Risk (continued)

Potential Alternative Implemented or Reason Not Implemented Not Implemented Add procedures to cope with and reduce Implemented Existing procedures adequate induced SGTR

Add emphasis on increasing the likelihood Implemented Implemented through SAMG of maintaining a coolable debris bed

Install containment inerting system Not Implemented Not cost beneficial. Very expensive with extremely small impact on public health risk. In addition, this alternative has the potential to increase the likelihood of containment failures at McGuire due to overpressurization.

Install reactor depressurization system Not Implemented Not cost beneficial. Very expensive with extremely small impact on public health risk. SAMG Program emphasize depressurizing RCS.

Install filtered containment vent system Not Implemented Not cost beneficial. Very expensive with extremely small impact on public health risk. SAMG Program provides guidance on venting strategy to minimize releases to public.

Install independent containment spray Not Implemented Not cost beneficial. Very expensive with system extremely small impact on public health risk. In addition, the alternative primarily reduces late containment failure. These occur many hours after core damage begins allowing plenty of time for recovery of containment heat removal equipment and implementation of SAMG strategies.

Install reactor cavity flooding system Not Implemented Not cost beneficial. Very expensive with extremely small impact on public health risk. SAMG Program provides guidance on putting water into containment for cooling the core debris. In addition, this alternative has the potential to increase the likelihood of containment failures at McGuire due to overpressurization from steam generation.

Install core retention device Not Implemented Not cost beneficial. Very expensive with extremely small impact on public health risk. SAMG Program provides guidance on putting water into containment for cooling the core debris.

30 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

7.0 Conclusions

Duke has performed a number of severe accident studies on McGuire and has implemented several plant enhancements to reduce the risk of severe accidents since the late 1980’s.

The results of the McGuire-specific analyses for severe accidents show that the total core damage frequency is estimated at 4.9E-05 per year, and the risk is estimated at 13.5 person-rem per year.

For the current residual severe accident risk, a SAMA analysis has been performed using PRA techniques and making use of industry studies and NRC reports providing guidance on performing cost-benefit analysis. This McGuire-specific analysis demonstrates that plant enhancements (severe accident mitigation and containment performance improvement) in excess of $2200 to $275,000 are not cost justified based on averted risk.

Because the environmental impacts of potential severe accidents are of small significance and because additional measures to reduce such impacts would not be justified from a public risk perspective, Duke concludes that no additional severe accident mitigation alternative measures beyond those already implemented during the current term license would be warranted for McGuire.

It is recognized that risk assessment studies are subject to varying degrees of uncertainty in the estimated core damage frequency, person-rem risk, and cost to implement alternatives. The results of this analysis show that the cost of implementing any of the alternatives is as much as several orders of magnitude higher than the estimated averted risk values. Therefore, no additional severe accident mitigation alternatives are cost- beneficial even when the uncertainties in the risk assessment process are considered.

31 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

8.0 References

Section 1.0

1.1 Preparation of Supplemental Environmental Reports for Applications to Renew Nuclear Power Plant Operating Licenses, Supplement 1 to Regulatory Guide 4.2, U. S. Nuclear Regulatory Commission, Washington, D. C., September 2000.

Section 2.0

2.1 Generic Letter 88-20, Individual Plant Examination for Severe Accident Vulnerabilities, USNRC, November 1988.

2.2 H. B. Tucker (Duke) letter dated November 4, 1991 to Document Control Desk (NRC), McGuire Units 1 and 2 Individual Plant Examination (IPE) Submittal, McGuire Nuclear Station, Docket Nos.: 50-369 and 50-370.

2.3 Nerses (NRC) letter dated June 30, 1994 to T. C. McMeekin (Duke), Evaluation of the McGuire Units 1 and 2 Individual Plant Examination (IPE) - Internal Events, McGuire Nuclear Station, Docket Nos., 50-369 and 50-370.

2.4 T. C. McMeekin (Duke) letter dated June 1, 1994 to Document Control Desk (NRC), Individual Plant Examination of External Events (IPEEE) Submittal, McGuire Nuclear Station, Docket Nos. 50-369 and 50-370.

2.5 Rinaldi (NRC) letter dated February 16, 1999 to H. B. Barron (Duke), Evaluation of the McGuire Units 1 and 2 Individual Plant Examination of External Events (IPEEE), McGuire Nuclear Station, Docket Nos., 50-369 and 50-370.

Section 3.0

3.1 H. B. Barron (Duke) letter dated March 19, 1998 to Document Control Desk (NRC), Probabilistic Risk Assessment, Individual Plant Examination, McGuire Nuclear Station, Docket Nos. 50-369 and 50-370.

32 McGuire Nuclear Station Severe Accident Mitigation Alternative (SAMA) Analysis

Section 4.0

4.1 Regulatory Analysis Guidelines of the U. S. Nuclear Regulatory Commission, NUREG/BR-0058, Revision 2, Final Report, U. S. Nuclear Regulatory Commission, Washington, D. C., November 1995.

4.2 Regulatory Analysis Technical Evaluation Handbook, NUREG/BR-0184, Revision 2, Final Report, U. S. Nuclear Regulatory Commission, Washington, D. C., January 1997.

4.3 Final Environmental Statement: Related To The Watts Bar Nuclear Plant Units 1 and 2, NUREG—0498 Supplement 1, U. S. Nuclear Regulatory Commission, Washington, D. C., April 1995, Docket Nos. 50-390 and 50-391.

Section 5.0

5.1 Code Manual for MACCS2: User’s Guide, Chanin, D. I., et al, NUREG/CR-6613. Volume 1, May 1998.

5.2 Individual Plant Examination Program: Perspectives on Reactor Safety and Plant Performance, NUREG-1560, Summary Report, U. S. Nuclear Regulatory Commission, Washington, D. C., October 1996.

33